How does DNS work?
Computers communicate using IP addresses, but people prefer names. DNS is the system that connects the two.
DNS is the internet's address book.
Imagine having to remember an IP address every time you wanted to visit a website. Instead, we use names such as cybercumbria.co.uk.
The Domain Name System — DNS — helps your device find the IP address associated with that name.
What happens when you type a website address?
Let's imagine you enter cybercumbria.co.uk into your browser.
Your browser and operating system first check whether they already know the answer.
If an answer is not already cached, your device asks its configured DNS resolver.
The resolver can follow the DNS hierarchy to discover which servers know the answer.
The authoritative DNS server provides the DNS record for the requested domain.
The resolver returns the answer and can cache it for future requests.
Your browser can now use the returned address to connect to the destination server.
DNS is a hierarchy.
There isn't one giant DNS server containing every domain on the internet. DNS is distributed across many different systems.
Points towards the appropriate top-level domain.
Helps identify the authoritative servers responsible further down the hierarchy.
Holds the DNS records for the domain.
Who actually answers your DNS requests?
Your device normally uses the DNS resolver configured by your network. This may ultimately be provided by your ISP, your organisation, or a public DNS service.
A widely used public recursive DNS resolver operated by Cloudflare.
Google's public recursive DNS service.
A public DNS resolver with a focus on security and blocking known malicious domains.
Your DNS path may have extra steps.
A device does not necessarily communicate directly with a public resolver. Home routers, filtering services and local DNS servers can sit between the device and the upstream resolver.
Needs to resolve a domain name.
Can filter domains and answer cached or local DNS requests.
Handles requests that still need to be resolved externally.
DNS stores much more than IP addresses.
Different record types provide different information about a domain and its services.
example.com → 203.0.113.42
example.com → 2001:db8::42
www.example.com → example.com
Where should email for this domain be delivered?
Verification, SPF and other domain information
Which authoritative DNS servers manage the zone?
IP address → hostname
DNS doesn't start from scratch every time.
DNS answers can be cached. This makes repeated lookups faster and reduces the amount of DNS traffic travelling across the internet.
Previously resolved information can temporarily be reused.
DNS records contain a TTL that helps determine how long an answer may be cached before it should be refreshed.
Traditional DNS isn't necessarily encrypted.
Traditional DNS queries can reveal which domain names a device is trying to resolve to systems able to observe that DNS traffic.
Sends DNS queries through an encrypted HTTPS connection.
Encrypts DNS using TLS, commonly over a dedicated port.
Why does a SOC analyst care about DNS?
DNS activity can provide valuable evidence about what devices on a network are trying to communicate with.
A device repeatedly resolving an unusual or known malicious domain may require investigation.
Malware can use DNS while attempting to locate or communicate with attacker-controlled infrastructure.
Attackers can attempt to encode data inside DNS queries and responses to create an unusual communication channel.
Large numbers of queries, strange subdomains or unexpected record types can provide useful investigation clues.
A single DNS lookup is rarely enough to decide that something is malicious. Analysts combine DNS evidence with other information such as endpoint activity, network connections, threat intelligence and authentication logs.
Ask DNS yourself.
Windows includes nslookup, while Linux systems commonly provide tools such as dig.
nslookup cybercumbria.co.uk
nslookup cybercumbria.co.uk 1.1.1.1
dig cybercumbria.co.uk
Ports: finding the right service.
DNS helped us find the server. Next we'll look at how ports help network traffic reach the correct service running on that server.